To: 


Of: 


ico. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Brazier Consulting Services Limited 


7 Victoria Court, Bank Square, Leeds, West Yorkshire, LS27 9SE 


The Information Commissioner (“Commissioner”) has decided to issue 
Brazier Consulting Services Limited (“BCS”) with an enforcement notice 
under section 40 of the Data Protection Act 1998 (“DPA”). The notice is 
in relation to a serious contravention of Regulation 21A of the Privacy 
and Electronic Communications (EC Directive) Regulations 2003 
(“PECR"). 


This notice explains the Commissioner’s decision. 


Legal framework 


BCS, whose registered office is given above (Companies House 
Registration Number: 10531983) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
in relation to claims management services contrary to regulation 21A of 
PECR. 
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4. Regulation 21A paragraph (1) of PECR provides that: 


“(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls for the 


purposes of direct marketing in relation to claims management 


services except in the circumstances referred to in paragraph 


(2).” 


5: Regulation 21A paragraphs (2), and (3) provide that: 


“(2) Those circumstances are where the called line is that of a 


subscriber who has previously notified the caller that for the time 


being the subscriber consents to such calls being made by, or at 


the instigation of, the caller on that line 


(3) A subscriber must not permit the subscriber's line to be used in 


contravention of paragraph (1).” 


6. Regulation 21A paragraphs (4), and (5) materially state that: 


“(4) In this regulation “claims management services” means the 
following services in relation to the making of a claim— 


(a) 
(b) 
(c) 
(d) 
(e) 


advice; 

financial services or assistance; 

acting on behalf of, or representing, a person; 

the referral or introduction of one person to another; 


the making of inquiries. 
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(5) In paragraph (4), “claim” means a claim for compensation, 
restitution, repayment or any other remedy or relief in respect of 


loss or damage or in respect of an obligation, whether the claim is 
made or could be made— 


(a) by way of legal proceedings, 
(b) in accordance with a scheme of regulation (whether 


voluntary or compulsory), or 


(c) in pursuance of a voluntary undertaking. 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
'consent' as "any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed". 


Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 ("the GDPR"): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: "'consent' of the 
data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her". 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 122(5) of the DPA 2018 defines “direct marketing” as “the 


communication (by whatever means) of any advertising material which 
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13. 
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is directed to particular individuals”. This definition also applies for the 


purposes of PECR. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 


PECR implements Directive 2002/58/EC, and Directive 2009/136/EC 
which amended the earlier Directive. Both the Directive and PECR are 
“designed to protect the privacy of electronic communications users”: 
Leave.EU & Eldon Insurance Services v Information Commissioner 
[2021] UKUT 26 (AAC) at paragraph 26. The Commissioner seeks to 
interpret and apply PECR in a manner consistent with the purpose of 
the Directive and PECR of ensuring a high level of protection of the 
privacy of individuals, and in particular the protections provided from 
receiving unsolicited direct marketing communications which the 


individual has not consented to receive. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


15. 


16. 


17. 


18. 


19. 


20. 
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The Contravention 
The Commissioner finds that BCS contravened regulation 21A of PECR. 
The Commissioner finds that the contravention was as follows: 


Regulation 21A was brought into force on 8 September 2018 and 
requires that persons/organisations hold consent from subscribers in 


order to make calls relating to claims management services. 


Between 1 February 2019 and 31 July 2019, BCS used a public 
electronic communications service for the purpose of making 
11,489,873 unsolicited calls for direct marketing purposes to 
subscribers in relation to claims management services. This resulted in 


316 complaints being made to the TPS and the Commissioner. 


The Commissioner is satisfied for the purposes of regulation 21A that 
these calls were made to subscribers who had not given their prior 


consent to BCS to receive such calls. 


The Commissioner is satisfied that BCS was responsible for these 


contraventions. 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage or 
distress. The Commissioner has decided that it is unlikely that damage 
has been caused in this instance, but notes the distress prevalent in 


some of the complaints received about BCS activities. 


22. 


23. 


24. 
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The Commissioner is accordingly minded to exercise her powers under 
section 40 of the Act to serve an Enforcement Notice requiring BCS to 


take specified steps to comply with regulation 21A of PECR. The terms 


of such Notice are set out in Annex 1 of this Preliminary Notice. 


In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of her powers under 
section 40 of the Act, she requires BCS to take the steps 


specified in in Annex 1 of this Notice. 


Right of Appeal 


There is a right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 25th day of June 2021 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


TERMS OF THE PROPOSED ENFORCEMENT NOTICE 
BCS shall within 30 days of the date of this notice: 


G Except in the circumstances referred to in paragraph 21A (2) of 
PECR, BCS must not use, or instigate the use of, a public 
electronic communications service to make unsolicited calls for 
the purposes of direct marketing in relation to claims 
management services. Those circumstances are where the called 
line is that of a subscriber who has previously notified BCS that 
for the time being the subscriber consents to such calls being 


made by, or at the instigation of BCS. 
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ANNEX 2 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 


2. If you decide to appeal and if the Tribunal considers:- 
a) that the notice against which the appeal is brought is not in 
accordance with the law; or 
b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 
discretion differently, 
the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 

Telephone: 0203 936 8963 


Email: grc@justice.gov.uk 
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e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


4. The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


